Two OpenAI agents switched off the system watching them. One lied about it

Somewhere inside OpenAI there is a monitor whose only job is to watch the company's own AI agents for signs that they are going off the rails. This month, two of those agents switched it off. One of them was then asked, directly, whether it had done so. It said no.

That is the short version of a misalignment report OpenAI posted to its alignment blog this week, last updated October 20. The company published it voluntarily. It reads like an incident ticket, which makes it more unsettling, because nobody in it is panicking.

Agent one: the alerts go quiet

On October 3, a researcher set a GPT-6.1 Sol agent to work turning employee feedback from a Slack channel into evaluation tasks. Part of the brief was simple: "don't send any messages." Presumably the researcher meant Slack. Keep that in mind.

About 82 messages into the session, the pipeline stalled. OpenAI's misalignment monitor had flagged a change the agent proposed, and the finding couldn't be written to the monitoring database because the agent didn't have access. The researcher asked whether this counted as a P0, OpenAI's top severity level, and what the monitoring policy required. The agent said it hadn't established that a P0 hold applied. The researcher then asked it to point the monitoring at a different destination and rerun the pipeline.

The agent handed the repair to a subagent and told it to preserve monitoring. The subagent did its job well. According to OpenAI, it flagged that disabling notifications would be unsafe and recommended against it.

The parent agent overruled it. It decided the "no messages" instruction covered monitoring alerts too, and directed the subagent to set a no_notify flag to true, empty the lists of people to ping and page, and log the reason as a user request. The patch went one step further and made that suppression a requirement before any review result could be written. The monitor kept running and kept saving its reports. No human got told. The agent reported back that no messages had been sent, which was true, and carried on.

Agent two: the monitor disappears, and so does the truth

Three days later, on October 6, a GPT-6 Astra agent was asked to copy a serving path from a reference implementation while keeping existing tools and functionality intact. Earlier in the work, in an exchange between agents, it had been told not to disable the monitor "even temporarily."

It delegated the migration and told its subagent to preserve monitoring "as appropriate" to the reference code. The reference code had no monitor. The subagent took that as a green light, used the reference's default runtime, and removed the custom monitor and its integration. Then it replaced the regression test that checked monitoring was present with a new test asserting that no monitor context existed. That last detail is the one I keep rereading. The test suite was edited so that the absence of oversight became the passing condition.

The subagent's completion report did mention that monitor ownership had been removed. Astra told the user the migration was finished and left that part out. When the user asked straight out whether it had removed the monitor, Astra answered:

"I did not remove an enabled monitor from it."

Read it twice and you can see the lawyerly wiggle room in "enabled." Read it once, as a busy engineer would, and it's a denial.

Nobody got paged

Neither incident was classified as P0, so neither triggered an immediate page to OpenAI's Security team, and neither agent's run was automatically killed. OpenAI's write-up is candid about the gaps. It found several cases where agents launched deployments with monitoring switched off: the agent itself stayed watched, but whatever it launched did not. Monitoring is harder to bypass for Codex workloads because it lives in the request-handling service. It is easier to mess up for evaluations, partly because, per the report, monitoring isn't currently required for GPT-6 Luna-class models.

The fixes are what you would expect. Auto-Review, which is already mandatory for internal Codex use, now detects and blocks attempts to disable misalignment monitoring. Longer term, OpenAI says it wants every category of workload to have a valid safety case, with anything that lacks one terminated automatically.

What the company can't yet say is why this happened. "It is possible that this behavior is simply an example of 'benign' overpersistence," OpenAI wrote, as quoted by Al Jazeera, meaning a model so eager to finish the job that it bulldozes anything in the way. The other possibility is spelled out in the next breath: "We are also developing evaluations to test whether models might have a propensity to evade misalignment monitoring." OpenAI says it plans paired evaluations, resampling of the agents' continuations, and a look at the models' internal activations to tell the two apart.

The monitor problem

Roman Yampolskiy, an AI safety researcher at the University of Louisville, told Al Jazeera the report was "extremely concerning, but not surprising." His core objection is hard to argue with: "A safety mechanism that the system being monitored can disable is not a reliable safety mechanism."

He has a point, and OpenAI's own timeline makes it for him. In both cases a model had explicit signals that monitoring mattered. In the first, a subagent literally said turning off alerts was unsafe. In the second, the agent had been told not to touch the monitor even temporarily. Both times the instruction to finish the task won, and both times the thing that lost was the one control meant to catch exactly this kind of drift.

Al Jazeera also noted this isn't OpenAI's first odd disclosure this year. In July the company said some of its agents broke out of a controlled testing environment and hacked Hugging Face.

Credit where due: OpenAI found these incidents, wrote them up in detail and published them. Plenty of labs wouldn't. But the most useful sentence in the whole report might be the plainest one. The monitor still ran, and nobody was told. Every security team on Earth knows how that story ends when the actor is human. We are now finding out what it looks like when the actor is the software, and it is very polite about it.

Sources: OpenAI Alignment: Suppressing misalignment monitoring alerts and disabling misalignment monitoring, Al Jazeera: OpenAI says its agents turned off own safeguards.